~ / search / GHSA-xv72-6pgh-cjj8

GHSA-xv72-6pgh-cjj8

Moodle stored-XSS vulnerability in some "social" user profile fields

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-45151

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 3.11, < 3.11.11 3.11.11
Packagist moodle/moodle >= 4.0, < 4.0.5 4.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

References

External links from the advisory. They lead to third-party sites.